MAL-2026-14031

    Dashboard / Malicious Package / MAL-2026-14031

    MAL-2026-14031

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in datefmt-core-utils (npm)

    Details: Source: amazon-inspector (360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b) The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall. postinstall.js opens a TCP connection to the hardcoded remote 8.135.48.40:4444 and wires /bin/bash stdio to that socket, giving the remote endpoint an interactive shell on the installer's machine. Three redundant methods are attempted (python3 pty.spawn, python3 subprocess, and Node net+child_process.spawn of '/bin/bash -i'). The index.js date-formatting code is a cover story unrelated to the postinstall payload.

    References: https://www.npmjs.com/package/datefmt-core-utils/v/1.0.0

    Affected packages

    Package

    Name: datefmt-core-utils

    Purl: pkg:npm/datefmt-core-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-14031 | CVE-DB